Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Thomas Gleixner e4346ffec2 perf/core: Prevent VMA split of buffer mappings ... commit b024d7b56c77191cde544f838debb7f8451cd0d6 upstream. The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping. Fixes: 45bfb2e504 ("perf/core: Add AUX area to ring buffer for raw data streams") Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27504 Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com> Acked-by: Vlastimil Babka <vbabka@suse.cz> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-08-28 16:21:23 +02:00
..
bpf	bpf: fix potential error return	2025-01-09 13:23:36 +01:00
cgroup	cgroup: Fix compilation issue due to cgroup_mutex not being exported	2025-06-04 14:32:29 +02:00
configs
debug	kdb: Use the passed prompt in kdb_position_cursor()	2024-08-19 05:33:40 +02:00
dma	dma: fix call order in dmam_free_coherent	2024-08-19 05:33:41 +02:00
events	perf/core: Prevent VMA split of buffer mappings	2025-08-28 16:21:23 +02:00
gcov	gcov: add support for GCC 14	2024-07-05 09:08:24 +02:00
irq	genirq/irqdesc: Honor caller provided affinity in alloc_desc()	2024-08-19 05:33:52 +02:00
livepatch	livepatch: fix race between fork and KLP transition	2022-10-26 13:22:18 +02:00
locking	locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()	2025-05-02 07:39:15 +02:00
power	PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()	2025-06-27 11:02:45 +01:00
printk	printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX	2025-03-13 12:43:02 +01:00
rcu	rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y	2025-06-04 14:32:34 +02:00
sched	sched/deadline: Use online cpus for validating runtime	2025-04-10 14:29:42 +02:00
time	posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()	2025-06-27 11:02:57 +01:00
trace	ftrace: Fix UAF when lookup kallsym after ftrace disabled	2025-06-27 11:02:52 +01:00
.gitignore
acct.c	acct: perform last write from workqueue	2025-03-13 12:43:26 +01:00
async.c	treewide: Remove uninitialized_var() usage	2023-06-09 10:29:01 +02:00
audit.c	audit: Send netlink ACK before setting connection in auditd_set	2024-02-23 08:24:54 +01:00
audit.h	audit: log AUDIT_TIME_* records only from rules	2022-04-15 14:18:04 +02:00
audit_fsnotify.c	audit: fix potential double free on error path from fsnotify_add_inode_mark	2022-09-05 10:27:38 +02:00
audit_tree.c	audit: move put_tree() to avoid trim_trees refcount underflow and UAF	2021-09-03 10:08:16 +02:00
audit_watch.c	audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()	2023-11-28 16:50:18 +00:00
auditfilter.c
auditsc.c	audit: fix possible soft lockup in __audit_inode_child()	2023-09-23 10:59:46 +02:00
backtracetest.c	treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()	2023-04-20 12:07:32 +02:00
bounds.c	bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS	2024-05-02 16:18:37 +02:00
capability.c
compat.c	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized	2023-04-05 11:16:42 +02:00
configs.c
context_tracking.c
cpu.c	hrtimers: Handle CPU state correctly on hotplug	2025-02-01 18:18:51 +01:00
cpu_pm.c
crash_core.c
crash_dump.c
cred.c	cred: switch to using atomic_long_t	2023-12-20 15:41:18 +01:00
delayacct.c
dma.c
exec_domain.c
exit.c	perf: Fix sample vs do_exit()	2025-06-27 11:02:58 +01:00
extable.c	kernel/extable.c: use address-of operator on section symbols	2023-06-09 10:29:01 +02:00
fail_function.c	kernel/fail_function: fix memory leak with using debugfs_lookup()	2023-03-11 16:44:15 +01:00
fork.c	fork: use pidfd_prepare()	2025-06-04 14:32:36 +02:00
freezer.c
futex.c	treewide: Remove uninitialized_var() usage	2023-06-09 10:29:01 +02:00
gen_kheaders.sh	kheaders: Ignore silly-rename files	2025-02-01 18:18:51 +01:00
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c
kallsyms.c
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c
kexec.c
kexec_core.c	kexec: fix a memory leak in crash_shrink_memory()	2023-07-27 08:37:10 +02:00
kexec_elf.c	kexec: initialize ELF lowest address to ULONG_MAX	2025-04-10 14:29:41 +02:00
kexec_file.c	kexec: support purgatories with .text.hot sections	2023-06-21 15:44:10 +02:00
kexec_internal.h
kheaders.c	kheaders: Use array declaration instead of char	2023-05-17 11:35:33 +02:00
kmod.c
kprobes.c	kprobes: Fix possible use-after-free issue on kprobe registration	2024-05-02 16:18:30 +02:00
ksysfs.c
kthread.c	kthread: fix task state in kthread worker if being frozen	2024-11-08 16:20:30 +01:00
latencytop.c
Makefile
module-internal.h
module.c	modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules	2023-09-23 10:59:36 +02:00
module_signature.c
module_signing.c
notifier.c
nsproxy.c
padata.c	padata: fix sysfs store callback check	2025-03-13 12:42:56 +01:00
panic.c	panic: Flush kernel log buffer at the end	2024-04-13 12:51:37 +02:00
params.c	module: ensure that kobject_put() is safe for module type kobjects	2025-06-04 14:32:27 +02:00
pid.c
pid_namespace.c	memcg: enable accounting for pids in nested pid namespaces	2021-09-22 12:26:37 +02:00
profile.c	profiling: fix shift too large makes kernel panic	2022-08-25 11:18:02 +02:00
ptrace.c	ptrace: Reimplement PTRACE_KILL by always sending SIGKILL	2022-06-14 18:11:24 +02:00
range.c
reboot.c	kernel/reboot: emergency_restart: Set correct system_state	2023-11-28 16:50:19 +00:00
relay.c	relayfs: fix out-of-bounds access in relay_file_read	2023-05-17 11:35:58 +02:00
resource.c	resource: fix region_intersects() vs add_memory_driver_managed()	2024-11-08 16:20:46 +01:00
rseq.c
seccomp.c	seccomp: Invalidate seccomp mode to catch death failures	2022-02-16 12:52:53 +01:00
signal.c	signal: Replace BUG_ON()s	2024-11-08 16:20:38 +01:00
smp.c	smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()	2024-09-12 11:03:54 +02:00
smpboot.c
smpboot.h
softirq.c	tasklet: Introduce new initialization API	2025-03-13 12:43:04 +01:00
stackleak.c
stacktrace.c
stop_machine.c
sys.c	getrusage: use sig->stats_lock rather than lock_task_sighand()	2024-03-15 10:48:19 -04:00
sys_ni.c	kernel/sys_ni: add compat entry for fadvise64_64	2022-09-05 10:27:38 +02:00
sysctl-test.c
sysctl.c	sched/rt: Disallow writing invalid values to sched_rt_period_us	2024-03-01 13:13:33 +01:00
sysctl_binary.c
task_work.c
taskstats.c
test_kprobes.c
torture.c
tracepoint.c	tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing	2021-07-14 16:53:08 +02:00
tsacct.c	taskstats: Cleanup the use of task->exit_code	2022-02-23 11:59:57 +01:00
ucount.c
uid16.c
uid16.h
umh.c
up.c
user-return-notifier.c
user.c
user_namespace.c
utsname.c
utsname_sysctl.c
watchdog.c	watchdog: export lockup_detector_reconfigure	2022-08-25 11:18:37 +02:00
watchdog_hld.c	watchdog/perf: properly initialize the turbo mode timestamp and rearm counter	2024-08-19 05:33:39 +02:00
workqueue.c	workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()	2023-10-25 11:53:18 +02:00
workqueue_internal.h